How to Write an AI Use Policy for Your Organisation (With Template)

What should an AI use policy cover?#

An AI use policy should answer the questions staff actually ask: which tools can I use, what can I use them for, what must I never paste in, who checks the output and who do I tell when something goes wrong. The template in this guide uses ten short sections, each with a named owner and a review date.

The policy is one part of AI governance. For the wider picture, read what AI governance is and how organisations begin.

How do you write an AI use policy, step by step?#

Write the policy from what is already happening, not from a blank page. Find out which tools staff use and why, decide which uses are acceptable, set the information rules, name owners, then publish, train and review. In a small organisation one manager can lead every step.

1. List the tools already in use. Ask teams which AI tools they use, including features built into software you already pay for.
2. Define the purposes. Write down what each tool is for. PDPC's guidelines ask organisations deploying generative AI to be disciplined about specifying the intended purpose and the amount of personal data needed for it.
3. Set the information rules. Say plainly what may and may not be entered into each tool. Under the PDPA, personal data is data about an individual who can be identified from that data, or from that data and other information the organisation has or is likely to have access to.
4. Decide how outputs are checked. Treat outputs as drafts and set who reviews what before it reaches a customer or affects an employee.
5. Name the owners. Give each rule a role: who approves tools, who handles incidents, who reviews the policy.
6. Cover tools that take actions. An AI agent that can send messages or change records needs tighter rules than a drafting tool.
7. Publish, train and review. Share the policy, walk staff through it and set a review date.

Before you write the rules for a high-stakes use, run a quick AI risk assessment. Our step-by-step guide to assessing AI risk includes a risk register you can copy.

What does Singapore guidance say a policy should reflect?#

PDPC's Advisory Guidelines on Use of Personal Data in Generative AI, issued on 20 July 2026, are the most direct source. They describe organisations that use generative AI systems as bearing primary responsibility for meeting their obligations under the Personal Data Protection Act (PDPA). PDPC states the guidelines are advisory, not legally binding and not legal advice.

The guidelines call these organisations System Deployers: those who use or enable the use of generative AI systems under their authority. Points that map neatly to a staff policy include:

• Purpose. Be disciplined about specifying the intended purpose and the amount of personal data required.
• New data sources. Safeguards should cover end-user prompts, inputs and generated outputs, agent or tool activity data and internal enterprise data, with responsibilities assigned for each.
• Telling users what to enter. Educate internal and external users on the specific types of personal data that should be input, for example only pre-defined categories.
• Writing it down. Develop clear written policies and document processes; making them available, for example on a website, demonstrates accountability.
• Reviewing. Regularly review whether safeguards are sufficient, especially where systems have agentic functions.

One worked example in the guidelines describes an organisation that makes its HR unit responsible for chatbot prompts and outputs, writes guidelines on the personal data allowed in prompts, scans prompts for common identifiers and shares its internal AI governance guidelines with all employees.

IMDA's Model AI Governance Framework for Generative AI sets out nine dimensions, including accountability, incident reporting, and testing and assurance. Its Model AI Governance Framework for Agentic AI suggests limiting an agent's access to tools and systems, making humans meaningfully accountable and enabling end-user responsibility.

AI use policy template#

The template below is a starting point to adapt to your organisation, not legal advice. Replace everything in square brackets, delete what does not apply and check the result against your own obligations, taking professional advice where needed. Keep the final version short enough that staff will read it.

AI USE POLICY: [Organisation name]
Version: [x.x]  Owner: [role]  Approved by: [role]  Next review: [date]

1. Purpose and scope
This policy sets out how staff, contractors and interns may use AI tools,
including generative AI, for work. It covers all work devices, accounts and data.

2. Approved tools
Use only the tools on the approved tools list kept by [role].
Ask [role] before using any other tool with work information.

3. Permitted and prohibited uses
You may use approved tools to: [draft internal documents, summarise
non-confidential material, brainstorm ideas].
You must not use AI tools to: [make final decisions about individuals,
give legal or medical advice] without approval from [role].

4. Information rules
Do not enter personal data or confidential client information into any
tool unless the approved tools list allows that category for that tool.
Allowed categories per tool: [list].

5. Checking outputs
Treat every AI output as a draft. The person using it checks facts,
figures, sources and tone before sharing. Outputs that affect customers
or staff are reviewed by [role] first.

6. Transparency
Tell [customers / recipients] when [content type] is produced mainly by AI.

7. AI agents and automation
Tools that can act on their own (send messages, change records, make
payments) need approval from [role], the least access needed and a named
person who can stop them.

8. Roles
Policy owner: [role]. Tool approval: [role].
Data protection questions and incidents: [role, e.g. Data Protection Officer].

9. Incidents
Report suspected data leaks, harmful outputs or misuse to [role]
at [contact] within [timeframe].

10. Training and review
Read this policy and complete [training] before using AI tools for work.
[Role] reviews this policy every [period] and whenever tools or uses change.

What might this look like in a Singapore workplace?#

Picture a small accounting practice in Jurong East where staff have started using a generative AI assistant to draft client emails. The partner wants simple rules before anyone pastes in client financial records. A one-page policy built from the template, plus a short team briefing, would give everyone the same answer to the same questions.

This is an illustrative scenario, not a real case. A sensible approach would be to:

• ask each person which AI tools they use and for which tasks
• approve one assistant for drafting and record it on the approved tools list
• state that client names, identification numbers and financial records are not entered unless the tool is approved for that category
• require the person sending an email to check every figure and name before it goes out
• name the office manager as the contact for incidents and tool requests
• set a review date and a trigger: any new tool feature that can act on its own

Common mistakes#

Most weak AI use policies fail in the same ways. They are too long to read, too vague to follow, silent on what information may be entered, or written once and never reviewed. A good policy is short, specific about data, clear about who owns each decision and updated when tools change.

• Writing a ban nobody follows. A blanket ban pushes use out of sight. Approve safe uses instead.
• Vague data rules. "Be careful with data" helps nobody. List the categories that may and may not be entered.
• No named owners. Every rule needs a role behind it.
• Ignoring built-in features. AI features inside existing software count as AI tools too.
• Forgetting agents. Tools that act on their own need separate rules on access and stopping them.
• Never reviewing. Set a date and a trigger for review.

For everyday habits that sit behind the policy, see responsible AI at work.

What to learn next#

A policy sets the rules; a risk assessment decides which uses need the strictest controls; and practice makes the rules feel natural. The guides below take you through each step with Singapore sources, and the course lets your team build and test a simple AI app with responsible use built in.

• Browse every guide in the AI governance category, or return to the AI learning pathway.
• To practise building and testing a simple AI app, see the GenAI Builder Sprint course.

Sources#

1. Advisory Guidelines on Use of Personal Data in Generative AI, Personal Data Protection Commission (PDPC), accessed 8 November 2026
2. Advisory Guidelines on Use of Personal Data in Generative AI (PDF), Personal Data Protection Commission (PDPC), accessed 8 November 2026
3. PDPA Overview, Personal Data Protection Commission (PDPC), accessed 8 November 2026
4. MGF for GenAI, AI Verify Foundation, accessed 8 November 2026
5. Model AI Governance Framework for Agentic AI, Infocomm Media Development Authority (IMDA), accessed 8 November 2026
6. Starter Kit for Testing LLM-Based Applications for Safety and Reliability, Infocomm Media Development Authority (IMDA), accessed 8 November 2026
7. What is AI Verify Testing Framework, AI Verify Foundation, accessed 8 November 2026

Frequently asked questions#

What is an AI use policy?+

A short written set of rules that tells staff which AI tools they may use, for what purposes, with what information, and who checks the results. It turns general principles into everyday instructions people can follow.

What should an AI use policy include?+

Purpose and scope, approved tools, permitted and prohibited uses, rules on personal and confidential information, how outputs are checked, transparency, rules for AI agents, named roles, incident reporting, and training and review.

What do PDPC's guidelines say about using generative AI tools at work?+

PDPC's Advisory Guidelines on Use of Personal Data in Generative AI describe System Deployers, who use or enable the use of generative AI systems under their authority, as bearing primary responsibility for ensuring the systems they choose can meet their PDPA obligations. The guidelines are advisory and not legally binding.

Should the policy say what personal data staff can type into AI tools?+

Yes. The PDPC guidelines describe educating end users on the specific types of personal data that should be input into a system, such as only pre-defined categories, and how that data will be processed. A clear list of what may and may not be entered does this.

Is the template in this guide legal advice?+

No. It is a starting point to adapt to your organisation, not legal advice. Check it against your own obligations and take professional advice where needed.

How often should an AI use policy be reviewed?+

Set a regular review date and also review it whenever tools or uses change. The PDPC guidelines say organisations should regularly review the sufficiency of their safeguards, especially where systems have agentic features.